Many software applications include some type of access control technology, either for the application itself or for one or more of the components used by the application such as database components or web services components. Access control technologies vary, and include role based security, user identification and authorization, rights based access, or access privileges. In certain cases, use of access control and the assignment of appropriate roles may be legally mandated. For example, the Health Insurance Portability and Accountability Act of 1996 includes security and data privacy provisions that make access control a vital part of software in the health care industry.
Access control may be complicated by the fact that software applications may be combined in workflows. Workflows are typically a series of two or more applications that perform a series of tasks. Each of the software applications in the workflow may use differing types and combinations of access control technology, each of which may require different roles, rights or privileges.
It is desirable that a user of a software application have a role with sufficient rights or privileges to use the application, but not more rights or privileges that appropriate for the role. Determining the appropriate role, rights or privileges can be difficult in an environment where multiple access control technologies may be present in a workflow or application. A user whose role or privileges are insufficient will be unable to successfully execute the application or workflow. A user whose role or privileges are set too high may be granted access to applications or data they shouldn't have.
Because it can be difficult to determine a correct role or privilege level, system administrators are often tempted to err on the side of making sure the user can run the application or workflow by setting the role or privilege level higher than the user's actual role warrants. This is undesirable because the user may then either inadvertently or maliciously gain access to software and data that the user is not meant to access.